A hardware level safety interlocked radiotherapy integrated control device

Abstract

The application relates to a radiotherapy integrated control device with a hardware-level safety interlock and belongs to the technical field of radiotherapy equipment. The radiotherapy integrated control device with the hardware-level safety interlock comprises a TCP operation panel and a TCP terminal controller in a split design, provides a radiotherapy integrated control device and system with a hardware-level safety interlock, realizes physical separation of communication and a safety link through an architecture that directly connects an operation panel to an upper computer, realizes core safety interlock functions by using a pure hardware circuit, creates a double-isolated medical-grade EMC protection system, designs a completely independent hard-wire emergency stop loop, completely solves safety hazards of existing radiotherapy control equipment from a hardware architecture level, and is completely consistent with mandatory standards of medical electrical equipment.

Description

Technical Field

[0001] This invention relates to a hardware-level safety interlocking integrated control device for radiotherapy, belonging to the field of radiotherapy equipment technology, and particularly to an integrated control device and system for radiotherapy equipment such as neutron therapy systems. Background Technology

[0002] Radiotherapy is one of the core treatment methods for malignant tumors. Modern precision radiotherapy systems consist of multiple subsystems, including a treatment bed, blocker, image-guided system, beam generation system, and safety interlock system. However, existing radiotherapy control equipment suffers from the following unavoidable safety defects and technical challenges in clinical applications: First, the control link is heavily coupled, and a single point of failure can easily lead to overall failure. Existing solutions often integrate the communication interface with the host computer into the terminal controller. Commands from the operation panel must be relayed through the terminal controller before interacting with the treatment control system. Once the terminal controller fails, it will simultaneously cause communication interruption and failure of safety functions. There is no physical isolation for redundancy protection, which does not meet the safety redundancy design requirements of radiotherapy equipment.

[0003] Second, the safety interlock relies on software implementation, which inherently poses safety risks. The existing equipment's hierarchical operation permissions and anti-accidental touch interlock logic are mostly implemented through the main control MCU's software program. If the software malfunctions, the MCU crashes, or electromagnetic interference causes program abnormalities, the safety interlock system will directly fail, leading to serious medical accidents such as accidental movement or beam ejection. This does not comply with the mandatory provisions of GB 9706.268-2022 "Medical Electrical Equipment - Part 2-68: Particular Requirements for Basic Safety and Basic Performance of Medical Electron Linear Accelerators".

[0004] Third, the anti-interference capability is insufficient and it cannot adapt to the complex electromagnetic environment of the radiotherapy room. The signal transmission of existing equipment mostly uses ordinary electrical signals and lacks medical-grade isolation and EMC protection. The high voltage and strong electromagnetic environment in the radiotherapy room can easily lead to signal distortion and false triggering, and it does not meet the mandatory EMC standards for medical electrical equipment.

[0005] Fourth, the emergency stop circuit design has flaws and insufficient reliability. In existing equipment, the emergency stop signal is mostly processed by the main control MCU before being output. The effectiveness of the emergency stop function depends on the normal operation of the system software. Once the MCU fails, the emergency stop function will completely fail, failing to meet the highest safety level requirements of radiotherapy equipment.

[0006] Therefore, there is an urgent need to find a radiotherapy device that can overcome the above-mentioned shortcomings. Summary of the Invention

[0007] To address the aforementioned issues, the present invention aims to provide an integrated radiotherapy control device and system with hardware-level safety interlocks. This system achieves physical separation of communication and security links through an architecture where the operation panel is directly connected to the host computer. It employs pure hardware circuitry to implement the core safety interlock function, creating a dual-isolation medical-grade EMC protection system. A completely independent hard-wired emergency stop circuit is designed, thoroughly resolving the safety hazards of existing radiotherapy control equipment at the hardware architecture level, while fully complying with mandatory standards for medical electrical equipment.

[0008] In a first aspect, the present invention provides an integrated control device for radiotherapy with hardware-level safety interlocks, comprising a split-design TCP operation panel and a TCP terminal controller; the TCP operation panel has an integrated industrial-grade printed circuit board (PCB), and the back of the panel has independent DB25 and RJ45 Ethernet interfaces; the TCP operation panel is electrically connected to the TCP terminal controller via the DB25 interface, and directly communicates bidirectionally with a treatment control system via the RJ45 Ethernet interface, realizing physical separation of the control communication link and the safety execution link; the PCB of the TCP operation panel integrates a hardware AND gate interlock unit, an independent hardwired emergency stop circuit, and a main control MCU unit; the hardware AND gate interlock unit uses an AND gate chip, and implements multi-condition interlocking logic for motion control through PCB hardwired wiring, the operation of which is independent of the main control MCU unit; the independent hardwired emergency stop circuit is directly connected to the emergency stop relay of the TCP terminal controller through independent PCB wiring and a dedicated core wire in the DB25 interface, and the transmission path of the emergency stop signal does not pass through the main control MCU unit.

[0009] In some embodiments, the hardware and door interlocking unit adopts a three-input AND gate chip. The three inputs of the three-input AND gate chip are respectively connected to the hard-wired output terminals of the three-level main switch, the enable button, and the corresponding motion button. The motion enable signal is output only when all three inputs meet the valid conditions simultaneously.

[0010] In some embodiments, the TCP operation panel is equipped with a three-level main switch, with three levels being the off position, the ready position, and the treatment position. Its output is independently connected in series in the motion control circuit, the image exposure circuit, and the beam output circuit via PCB hard wires, thereby achieving hardware-level physical isolation of operation permissions.

[0011] In some embodiments, the PCB board of the TCP operation panel also integrates an isolation interface unit and a medical-grade EMC protection unit; the isolation interface unit includes an optocoupler isolation module and a magnetic isolation module, used to achieve signal electrical isolation between the TCP operation panel and the TCP terminal controller; the medical-grade EMC protection unit includes a TVS diode connected in parallel to the signal interface, a self-resetting fuse connected in series in the power supply circuit, and a safety Y capacitor set in the network port circuit.

[0012] In some embodiments, the main control MCU unit is externally connected to a dual crystal oscillator circuit, which is used only for key signal acquisition, indicator light driving, display screen data refresh, and Ethernet data interaction.

[0013] In some embodiments, the TCP terminal controller has a built-in hardware beam signal pulse verification unit. The hardware beam signal pulse verification unit uses FPGA pure hardware circuitry to generate and verify pulses. Only when the output pulse sequence continuously conforms to the preset rules is the valid beam output enable signal output to the beam system.

[0014] In some embodiments, the preset rules are: pulse period 30ms±10%, pulse width 3ms±10%; a valid beam output enable signal is only output when 32 consecutive pulse signals conforming to the rules are output; when 8 consecutive pulses do not conform to the rules, or when there are no valid pulses for 2 consecutive signal cycles, the output of the beam signal is immediately terminated.

[0015] In some embodiments, the TCP terminal controller adopts a partitioned transmission architecture of hardwire and multimode fiber; the TCP terminal controller transmits control signals with the treatment bed, blocker, and imaging system via hardwire, and achieves bidirectional full signal transmission with the beam system and safety interlock system via multimode fiber.

[0016] Secondly, a radiotherapy integrated safety control system is provided, including a radiotherapy integrated control device with hardware-level safety interlocks, and further including a treatment control system, a treatment bed, a blocker, an imaging system, a beam system, a safety interlock system, and a machine room warning light; the treatment control system is directly connected to the RJ45 Ethernet interface of the TCP operation panel for communication via a shielded network cable.

[0017] Thirdly, the present invention provides a radiotherapy safety control method based on the said system, comprising the following hardware execution steps: S1, hardware isolation of permissions: Through the hardware wiring of the three-level hierarchical main switch, the operation permissions are physically isolated into the off position, the ready position and the treatment position. S2, Hardware interlock trigger: During motion control, the hardware and door interlock unit will only output a valid enable signal when the three-level main switch is in the ready position and the enable button and the corresponding motion button are pressed at the same time. S3, Independent Emergency Stop Protection: Pressing the emergency stop button in any state will directly cut off the power supply to the emergency stop relay in the terminal controller via an independent hard-wired emergency stop circuit. This process does not go through the main control MCU unit. S4, Beam Pulse Verification: When the beam exits, the hardware pulse verification unit generates a pulse sequence that conforms to preset rules. After continuously outputting valid pulses, the beam system starts beam exiting. During the beam exiting process, the pulse signal is verified in real time, and beam exiting is terminated immediately if any abnormality occurs.

[0018] Advantages and effects of the present invention: This invention addresses several technical shortcomings of existing radiotherapy control equipment, including severe coupling between control and safety links leading to overall failure at a single point of failure, inherent failure risks due to software-based safety interlocks, insufficient electromagnetic interference resistance making it unsuitable for the complex environment of radiotherapy rooms, and unreliable emergency stop circuits processed by the main control MCU. Through a systematic hardware safety design—including a dual-link physical separation architecture with direct connection between the operator panel and the host computer, pure hardware with door interlocks and independent hard-wired emergency stop circuits, a dual-isolation medical-grade EMC protection system, and hardware-level beam pulse verification—the core safety functions are completely decoupled from software execution. This hardware architecture constructs multiple safety defenses compliant with the GB 9706 series of mandatory standards for medical electrical equipment, fundamentally eliminating the risk of safety interlock failures caused by software malfunctions, MCU crashes, or electromagnetic interference. This provides highly reliable integrated control and safety assurance for radiotherapy. Specifically, it also includes: 1. Physical separation of control communication and safety execution links eliminates the risk of overall failure from a single point of failure at the architectural root: An innovative split architecture is adopted, directly connecting the TCP operator panel to the treatment control system. Direct bidirectional communication with the host computer is achieved via an RJ45 Ethernet interface, while an independent safety execution link is established with the TCP terminal controller via a DB25 interface. This design completely physically isolates the control communication link from the safety execution link, ensuring that even if the terminal controller experiences a serious failure, communication between the operator panel and the host computer remains unaffected, and core safety functions such as emergency stop and interlocking continue to operate independently and effectively. This architectural solution addresses the key challenge in the background technology of "simultaneous communication interruption and safety function failure caused by a single point of failure," providing true fault redundancy protection.

[0019] 2. Pure hardware AND gate interlock and independent hard-wired emergency stop, completely eliminating reliance on the main control MCU: The core safety interlock uses an AND gate chip to implement multi-condition interlock logic through hard-wired PCB wiring. The motion enable signal output is completely independent of the main control MCU unit. The emergency stop circuit is directly connected to the emergency stop relay in the terminal controller through independent PCB traces and DB25 dedicated core wires, with the signal transmission path not involving any software processing. This pure hardware safety architecture ensures that even if the MCU crashes, the program malfunctions, or the program is abnormal due to electromagnetic interference, the safety interlock and emergency stop functions remain 100% effective, fully complying with the mandatory requirements of GB 9706.268-2022 for the basic safety of medical electronic linear accelerators, fundamentally avoiding the inherent safety hazards of software-implemented safety interlocks.

[0020] 3. Dual isolation and medical-grade EMC protection work together to ensure signal integrity and operational stability in complex electromagnetic environments: A dual electrical isolation barrier is constructed using optocoupler and magnetic isolation modules, achieving fully isolated signal transmission between the control panel and the terminal controller. Simultaneously, a medical-grade EMC protection circuit, consisting of TVS diode surge protection, self-resetting fuse overcurrent protection, and safety-certified Y-capacitor filtering, forms a multi-layered suppression of conducted and radiated interference. This dual isolation and protection system is perfectly suited to the complex high-voltage and strong electromagnetic conditions in radiotherapy rooms, effectively avoiding signal distortion and false triggering, and significantly improving the stability and reliability of the equipment during long-term operation in strong electromagnetic environments.

[0021] 4. Hardware-level beam pulse verification eliminates the risk of erroneous beam output from the source through strict physical rules: A beam signal pulse verification unit based on FPGA pure hardware circuitry is set up in the TCP terminal controller. Multiple rules, including preset pulse period, pulse width, and consecutive valid counts, are used to verify the output beam signal in real time. Beam output is only allowed when a continuous pulse sequence conforms to the rules; any abnormalities are immediately terminated. This hardware verification mechanism does not rely on software judgment at all, completely blocking the risk of continuous or erroneous beam output caused by software failures at the physical level, providing a final, solid hardware defense line for patient treatment safety.

[0022] 5. Integrated panel and partitioned transmission architecture simplify clinical operation procedures while ensuring efficient coordination of subsystem control: Integrating the control functions of multiple subsystems into a single panel eliminates the need for operators to switch between multiple devices, reducing operational complexity and the risk of misoperation due to distraction. Simultaneously, the TCP terminal controller employs a partitioned transmission architecture using both hardwired and multimode fiber. Hardwired direct connections are used for subsystems with high real-time requirements, such as treatment beds and stoppers, while multimode fiber is used for beam systems and safety interlock systems to achieve bidirectional full signal transmission. This ensures real-time control while improving the anti-interference capability of long-distance signal transmission, comprehensively optimizing the clinical operation experience and system coordination efficiency. Attached Figure Description

[0023] Figure 1 is a schematic diagram of the overall structure of the integrated radiotherapy control device of the present invention; Figure 2 is an overall architecture diagram of the radiotherapy integrated safety control system described in this invention; Figure 3 is a circuit block diagram of the hardware and door interlocking logic described in this invention; Figure 4 is a schematic diagram of the core circuit of the TCP operation panel PCB described in this invention.

[0024] Explanation of reference numerals in the attached figures: 1. TCP Operation Panel; 2. TCP Terminal Controller; 3. Treatment Control System; 4. Treatment Bed; 5. Blocker; 6. Imaging System; 7. Beam System; 8. Room Warning Lights; 9. Safety Interlock System; 401. Main Control MCU Unit; 402. Hardware and Door Interlock Unit; 403. Ethernet Communication Unit; 404. Independent Hardwired Emergency Stop Circuit; 405. Isolation Interface Unit; 406. Medical-Grade EMC Protection Unit. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] In this invention, unless otherwise explicitly specified and limited, the terms "connected," "linked," and "fixed" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0027] In this invention, the terms "first" and "second" are used only to distinguish similar components / parts in different positions or with different characteristics, and have no other limiting meaning; "upper" refers to the direction in which each component is away from the ground, and "lower" refers to the direction in which each component is away from the ground.

[0028] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0029] The purpose of this invention is to provide an integrated radiotherapy control device and system with hardware-level safety interlocks. It achieves physical separation of communication and security links through an architecture where the operation panel is directly connected to the host computer. It uses pure hardware circuits to implement the core safety interlock function, creates a dual-isolated medical-grade EMC protection system, and designs a completely independent hard-wired emergency stop circuit. It completely solves the safety hazards of existing radiotherapy control equipment from the hardware architecture level, while fully complying with the mandatory standards for medical electrical equipment.

[0030] This invention addresses several technical shortcomings of existing radiotherapy control equipment, including severe coupling between control and safety links leading to overall failure at a single point of failure, inherent failure risks due to software-dependent safety interlocks, insufficient electromagnetic interference resistance making it unsuitable for the complex environment of radiotherapy rooms, and unreliable emergency stop circuits processed by the main control MCU. It employs a systematic hardware safety design that completely decouples core safety functions from software execution. This design, based on a dual-link physical separation architecture (direct connection of the operation panel to the host computer), pure hardware with door interlocks and independent hard-wired emergency stop circuits, a dual-isolation medical-grade EMC protection system, and hardware-level beam pulse verification, constructs multiple safety defenses compliant with the GB 9706 series of mandatory standards for medical electrical equipment at the hardware architecture level. This fundamentally eliminates the risk of safety interlock failures caused by software malfunctions, MCU crashes, or electromagnetic interference, providing highly reliable integrated control and safety assurance for radiotherapy.

[0031] In a first aspect, the present invention provides an integrated control device for radiotherapy with hardware-level safety interlocks, comprising a split-design TCP operation panel 1 and a TCP terminal controller 2. The TCP operation panel 1 is placed on the operating table in the radiotherapy control room and has a flame-retardant ABS engineering plastic injection-molded shell for use by radiotherapy technicians. The TCP terminal controller 2 has a cold-rolled steel plate stamped shell and is a standard 1U rack-mount structure, installed in a 19-inch standard cabinet in the equipment room, away from the strong electromagnetic environment of the radiotherapy room.

[0032] The TCP operation panel 1 incorporates a 4-layer industrial-grade printed circuit board (PCB). The inner layers of the PCB feature complete ground and power planes, enhancing anti-interference capabilities and complying with EMC standards for medical electrical equipment. The back of the panel houses independent DB25 and RJ45 Ethernet interfaces. The TCP operation panel 1 connects to the TCP terminal controller 2 via a 30m shielded DB25 signal cable. The signal cable employs a twisted-pair shielded structure, with both ends of the shield reliably connected to the protective grounding terminals of both devices, achieving a shielding effectiveness of at least 60dB. The TCP operation panel 1 also communicates directly and bidirectionally with a treatment control system 3 via a 30m shielded Cat5e Ethernet cable through the RJ45 Ethernet interface, eliminating the need for relaying through the TCP terminal controller 2 and achieving physical separation of the control communication link and the safety execution link. This design completely physically isolates the control communication link from the safety execution link, ensuring that even in the event of a serious failure of the TCP terminal controller 2, communication between the TCP operation panel 1 and the treatment control system 3 remains unaffected, and core safety functions such as emergency stop and interlocking continue to operate independently and effectively. This architectural approach solves the critical challenge of simultaneous communication interruption and safety function failure caused by a single point of failure, providing true fault redundancy protection.

[0033] The PCB board of TCP operation panel 1 integrates a hardware AND gate interlock unit 402, an independent hardwired emergency stop circuit 404, and a main control MCU unit 401. The hardware AND gate interlock unit 402 uses an AND gate chip and implements multi-condition interlocking logic for motion control through hardwired wiring on the PCB. The operation of this interlocking logic is independent of the main control MCU unit 401. The independent hardwired emergency stop circuit 404 is directly connected to the emergency stop relay of the TCP terminal controller 2 via dedicated wires within the DB25 interface and independent PCB traces. The transmission path of this emergency stop signal does not pass through the main control MCU unit 401. This pure hardware safety architecture ensures that even in the event of MCU crashes, program errors, or program anomalies caused by electromagnetic interference, the safety interlocking and emergency stop functions remain effective, fully complying with the mandatory requirements of GB 9706.268-2022 for the basic safety of medical linear accelerators, fundamentally avoiding the inherent safety hazards of software-implemented safety interlocking.

[0034] In some embodiments, the hardware AND gate interlocking unit 402 uses two SN74HC11 three-input AND gate chips, corresponding to the treatment bed control circuit and the stopper control circuit, respectively. The three inputs of the three-input AND gate chip are connected to the hard-wired outputs of the three-level main switch, the enable button, and the corresponding motion button. A motion enable signal is output only when all three inputs simultaneously meet the valid conditions. Taking the treatment bed control circuit as an example, the three inputs of the AND gate chip are connected to the ready position output of the three-level main switch, the output of the enable button, and the output of the treatment bed button, respectively. Only when all three inputs are simultaneously high-level will the AND gate output a high-level enable signal, triggering the treatment bed to move. Releasing any button immediately stops the movement, achieving a purely hardware-based anti-accidental touch interlock.

[0035] In some embodiments, the TCP operation panel 1 is equipped with a three-level main switch, with three positions: off, ready, and treatment. Its output is independently connected in series with the motion control circuit, the image exposure circuit, and the beam output circuit via PCB hard wiring, respectively, to achieve hardware-level physical isolation of operation permissions. In the off position, all control circuits are disconnected; in the ready position, only the motion control circuit and the image exposure circuit are connected; and in the treatment position, only the beam output circuit is connected.

[0036] In some embodiments, the PCB board of the TCP operation panel 1 also integrates an Ethernet communication unit 403, an isolation interface unit 405, and a medical-grade EMC protection unit 406. The Ethernet communication unit 403 adopts an ENC28J60-I / SO industrial-grade Ethernet controller, which is connected to the main control MCU unit 401 via an SPI bus. It is equipped with an RJ45 network port with 1.5kV isolation, and the differential trace impedance is controlled to 100Ω, which conforms to the Ethernet communication standard. It realizes TCP / IP bidirectional communication with the treatment control system 3 to transmit treatment plan instructions and equipment status feedback data.

[0037] The isolation interface unit 405 includes an optocoupler isolation module and a magnetic isolation module, used to achieve electrical isolation of signals between the TCP operation panel 1 and the TCP terminal controller 2. Digital input signals use EL357N optocoupler isolation with an isolation voltage of not less than 2.5kV; RS485 communication signals use ADUM1200 magnetic isolation chips with an isolation voltage of not less than 5kV, achieving full electrical isolation of signals between the operation panel and the terminal controller.

[0038] The medical-grade EMC protection unit 406 includes an SMAJ24A TVS diode connected in parallel to the signal interface, an MF-MSMF030-2 self-resetting fuse connected in series in the power supply circuit, and a safety Y capacitor installed in the network port circuit. The TVS diode has a clamping voltage of 26.7V and a peak pulse power of 400W; the self-resetting fuse has a holding current of 0.3A and an operating current of 0.6A; a 22Ω terminating resistor is connected in series on the signal line of the network port circuit, and a 1nF / 2KV safety Y capacitor is connected in parallel to ground, meeting the safety requirements of GB 9706.1-2020. This dual isolation and medical-grade EMC protection system constructs a dual signal electrical isolation barrier through optical and magnetic isolation modules, achieving fully isolated signal transmission between the operation panel and the terminal controller. Simultaneously, it is equipped with a multi-layered electromagnetic compatibility protection circuit consisting of TVS diode surge protection, self-resetting fuse overcurrent protection, and safety-certified Y-capacitor filtering, effectively suppressing conducted and radiated interference. It perfectly adapts to the complex operating conditions of high voltage and strong electromagnetic fields in radiotherapy rooms, effectively avoiding signal distortion and false triggering, and significantly improving the stability and reliability of the equipment during long-term operation in strong electromagnetic environments.

[0039] In some embodiments, the main control MCU unit 401 adopts an STM32F407VET6 industrial-grade main control chip, with an external dual crystal oscillator circuit. An 8MHz passive crystal oscillator is used for the RTC clock, and a 25MHz passive crystal oscillator is used for the system main frequency. The chip's I / O ports are connected to the operation buttons, status indicator module, display module, and Ethernet controller, respectively, and are used only for button signal acquisition, indicator light driving, display screen data refresh, and Ethernet data interaction.

[0040] In some embodiments, the TCP terminal controller 2 incorporates a hardware beam signal pulse verification unit. This unit uses FPGA-based pure hardware circuitry to generate and verify pulses. Only when the output pulse sequence continuously conforms to preset rules is a valid beam output enable signal sent to the beam system 7. This hardware verification mechanism is completely independent of software judgment, physically eliminating the risk of continuous or erroneous beam output caused by software malfunctions, thus providing a final, solid hardware defense for patient treatment safety.

[0041] In some embodiments, the preset rules are: pulse period 30ms±10% and pulse width 3ms±10%; a valid beam output enable signal is only output when 32 consecutive pulse signals conforming to the rules are output; when 8 consecutive pulses do not conform to the rules, or when there are no valid pulses for 2 consecutive signal cycles, the output of the beam signal is immediately terminated.

[0042] In some embodiments, the TCP terminal controller 2 employs a partitioned transmission architecture using hardwired and multimode fiber optic cables. The TCP terminal controller 2 transmits control signals to the treatment bed 4, the blocker 5, and the imaging system 6 via hardwired cables, and to the beam system 7 and the safety interlock system 9 via multimode fiber optic cables, achieving bidirectional full signal transmission with complete electrical isolation and thoroughly eliminating the risk of erroneous beam output caused by electromagnetic interference and electrical coupling. The TCP terminal controller 2 also has an industrial-grade power conversion module internally installed, converting AC220V mains power to DC24V direct current, which powers the TCP operation panel 1 via shielded DB25 signal lines. The coil of the emergency stop relay is connected to an independent hardwired emergency stop circuit 404, and three sets of normally closed contacts are connected in series in all control circuits.

[0043] This invention integrates the control functions of multiple subsystems into the TCP operation panel 1, eliminating the need for operators to switch between multiple devices, thus reducing operational complexity and the risk of misoperation due to distraction. Simultaneously, the TCP terminal controller 2 employs a partitioned transmission architecture using both hardwired and multimode fiber. Hardwired direct connections are used for subsystems with high real-time requirements, such as the treatment bed 4 and the stopper 5, while multimode fiber is used for the beam system 7 and the safety interlock system 9 to achieve bidirectional full signal transmission. This ensures real-time control while improving the anti-interference capability of long-distance signal transmission, comprehensively optimizing the clinical operating experience and system collaboration efficiency.

[0044] Secondly, this invention provides an integrated safety control system for radiotherapy, including the aforementioned integrated control device for radiotherapy with hardware-level safety interlocks, and further including a treatment control system 3, a treatment bed 4, a depressor 5, an imaging system 6, a beam system 7, a safety interlock system 9, and a room warning light 8. The treatment control system 3 communicates directly with the RJ45 Ethernet interface of the TCP operation panel 1 via a shielded network cable. Safety execution signals of all subsystems are relayed and controlled through the TCP terminal controller 2, achieving dual-link separation for communication and safety.

[0045] Thirdly, the present invention provides a radiotherapy safety control method based on this system, comprising the following hardware execution steps: S1, Hardware Isolation of Access Control: The operation access is physically isolated into three levels: Off, Ready, and Treatment, through hardware wiring of a three-level main switch. In the Off mode, all control circuits are disconnected; in the Ready mode, only the motion control circuit and the image exposure circuit are connected; and in the Treatment mode, only the beam output circuit is connected.

[0046] S2, Hardware Interlock Trigger: During motion control, the hardware and door interlock unit 402 will only output a valid enable signal when the three-level main switch is in the ready position and the enable button and the corresponding motion button are pressed at the same time, triggering the treatment bed 4 or the blocker 5 to move. Releasing either button will immediately stop the movement.

[0047] The blocking device movement is triggered when the main switch is in the ready position, the enable button and the blocking button are pressed simultaneously, and the three signals are connected in series through a gate circuit; none of these conditions can be omitted. The treatment bed movement is triggered when the main switch is in the ready position, the enable button and the treatment bed button are pressed simultaneously, and the three signals are connected in series through a gate circuit; none of these conditions can be omitted. The image exposure is triggered when the main switch is in the ready position, the exposure button is pressed, and two signals are connected in series; none of these conditions can be omitted. The beam output is triggered when the main switch is in the treatment position, the beam output button is pressed, and the hardware pulse verification unit outputs a valid pulse; all three signals are connected in series; none of these conditions can be omitted.

[0048] S3, Independent Emergency Stop Protection: Pressing the emergency stop button in any state directly cuts off the power supply to the emergency stop relay in the terminal controller via the independent hard-wired emergency stop circuit 404. All normally closed contacts open, cutting off the power supply to all control circuits and terminating all equipment movement and beam output. This process does not go through the main control MCU unit 401. At the same time, an emergency stop signal is sent to the safety interlocking system 9 and the beam system 7 via optical fiber, and the entire system enters the emergency stop state.

[0049] S4, Beam Pulse Verification: When the beam exits, the hardware pulse verification unit generates a pulse sequence that conforms to preset rules. After continuously outputting 32 valid pulses, the beam system 7 starts beam exiting. The pulse signal is verified in real time during beam exit, and beam exit is immediately terminated if an abnormality is found. Pressing the pause button during beam exit will immediately pause beam exit; releasing the button requires pressing it again to resume beam exit.

[0050] The workflow of this invention includes: During the power-on self-test phase, the power supply to the TCP terminal controller 2 is turned on. The device completes hardware circuit self-test, fiber optic link continuity self-test, and emergency stop circuit status self-test. After the TCP operation panel 1 establishes normal communication with the treatment control system 3 via the RJ45 interface, it enters standby mode. During the patient positioning phase, the three-level graded main switch is turned to the ready position. The treatment control system 3 sends a motion command to the TCP operation panel 1 via Ethernet. The operator simultaneously presses the enable button and the corresponding motion button. The hardware and door interlock unit 402 outputs a valid enable signal, controlling the treatment bed 4 or the stopper 5 to move to the designated position. Releasing either button immediately stops the movement. During the image positioning phase, after positioning is completed, the treatment control system 3 sends an image exposure command to the TCP operation panel 1. The operator presses the exposure button, and the imaging system 6 begins exposure. Releasing the exposure button immediately stops the exposure. During radiotherapy, after confirming accurate image localization, the three-stage main switch is turned to the treatment position. The treatment control system 3 sends a beam output request to the TCP operation panel 1. The operator presses the output button, and the hardware pulse verification unit in the TCP terminal controller 2 generates a pulse sequence that conforms to preset rules. After continuously outputting 32 valid pulses, the beam system 7 starts outputting the beam. Emergency stop can be triggered by pressing the emergency stop button in any state.

[0051] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make various modifications and alterations without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the claims.

Claims

1. A radiotherapy integrated control device with hardware-level safety interlocks, characterized in that, The system includes a split-design TCP operation panel and a TCP terminal controller. The TCP operation panel has an integrated industrial-grade printed circuit board (PCB) with independent DB25 and RJ45 Ethernet interfaces on its back. The TCP operation panel is electrically connected to the TCP terminal controller via the DB25 interface and communicates directly and bidirectionally with a treatment control system via the RJ45 Ethernet interface, achieving physical separation between the control communication link and the safety execution link. The PCB of the TCP operation panel integrates a hardware AND gate interlocking unit, an independent hard-wired emergency stop circuit, and a main control MCU unit. The hardware AND gate interlocking unit uses an AND gate chip and implements multi-condition interlocking logic for motion control through hard-wired wiring on the PCB. The operation of this interlocking logic is independent of the main control MCU unit. The independent hard-wired emergency stop circuit is directly connected to the emergency stop relay of the TCP terminal controller via independent PCB traces and dedicated wires within the DB25 interface. The transmission path of this emergency stop signal does not pass through the main control MCU unit.

2. The integrated control device for radiotherapy with hardware-level safety interlocking according to claim 1, characterized in that, The hardware and door interlocking unit uses a three-input AND gate chip. The three inputs of the three-input AND gate chip are respectively connected to the hard-wired output terminals of the three-level main switch, the enable button, and the corresponding motion button. The motion enable signal is only output when all three inputs meet the valid conditions simultaneously.

3. The integrated radiotherapy control device with hardware-level safety interlock as described in claim 2, characterized in that, The TCP operation panel is equipped with a three-level main switch, with three positions: off, ready, and treatment. Its output is connected in series with the motion control circuit, image exposure circuit, and beam output circuit via PCB hard wires, respectively, to achieve hardware-level physical isolation of operation permissions.

4. The integrated control device for radiotherapy with hardware-level safety interlocking according to claim 1, characterized in that, The TCP operation panel's PCB board also integrates an isolation interface unit and a medical-grade EMC protection unit; the isolation interface unit includes an optocoupler isolation module and a magnetic isolation module, used to achieve signal electrical isolation between the TCP operation panel and the TCP terminal controller; the medical-grade EMC protection unit includes a TVS diode connected in parallel to the signal interface, a self-resetting fuse connected in series in the power supply circuit, and a safety Y capacitor installed in the network port circuit.

5. The integrated control device for radiotherapy with hardware-level safety interlocking according to claim 1, characterized in that, The main control MCU unit is connected to a dual crystal oscillator circuit, which is used only for key signal acquisition, indicator light driving, display screen data refresh, and Ethernet data interaction.

6. The integrated control device for radiotherapy with hardware-level safety interlocking according to claim 1, characterized in that, The TCP terminal controller has a built-in hardware beam signal pulse verification unit. The hardware beam signal pulse verification unit uses FPGA pure hardware circuit to realize pulse generation and verification. Only when the output pulse sequence continuously conforms to the preset rules will it output a valid beam output enable signal to the beam system.

7. The integrated radiotherapy control device with hardware-level safety interlock as described in claim 6, characterized in that, The preset rules are: pulse period 30ms±10%, pulse width 3ms±10%; a valid beam output enable signal is only output when 32 consecutive pulse signals conforming to the rules are output; when 8 consecutive pulses do not conform to the rules, or when there are no valid pulses for 2 consecutive signal cycles, the output of the beam signal is immediately terminated.

8. The integrated control device for radiotherapy with hardware-level safety interlocking according to claim 1, characterized in that, The TCP terminal controller adopts a partitioned transmission architecture using hardwired and multimode fiber. The TCP terminal controller transmits control signals to the treatment bed, blocker, and imaging system via hardwired transmission, and to the beam system and safety interlock system via multimode fiber to achieve bidirectional full signal transmission.

9. An integrated safety control system for radiotherapy, characterized in that, The radiotherapy integrated control device with hardware-level safety interlock, as described in any one of claims 1 to 8, further includes a treatment control system, a treatment bed, a blocker, an imaging system, a beam system, a safety interlock system, and a machine room warning light; the treatment control system is directly connected to the RJ45 Ethernet interface of the TCP operation panel via a shielded network cable.

10. A radiotherapy safety control method based on the system of claim 9, characterized in that, The following hardware execution steps are included: S1, hardware isolation of permissions: Through the hardware wiring of the three-level hierarchical main switch, the operation permissions are physically isolated into the off position, the ready position and the treatment position. S2, Hardware interlock trigger: During motion control, the hardware and door interlock unit will only output a valid enable signal when the three-level main switch is in the ready position and the enable button and the corresponding motion button are pressed at the same time. S3, Independent Emergency Stop Protection: Pressing the emergency stop button in any state will directly cut off the power supply to the emergency stop relay in the terminal controller via an independent hard-wired emergency stop circuit. This process does not go through the main control MCU unit. S4, Beam Pulse Verification: When the beam exits, the hardware pulse verification unit generates a pulse sequence that conforms to preset rules. After continuously outputting valid pulses, the beam system starts beam exiting. During the beam exiting process, the pulse signal is verified in real time, and beam exiting is terminated immediately if any abnormality occurs.

Images